f51ad0b62049323c95b48f46c8a892a040f302079ef76f2003755663939b1c26

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b65b2424e5320c302cefac03d040f9d2_elex_mafia_stealc_tofsee.exe
Size 613KB
Sample260720-p35n8aax9p
SHA256 f51ad0b62049323c95b48f46c8a892a040f302079ef76f2003755663939b1c26
MD5 b65b2424e5320c302cefac03d040f9d2
SHA1 3e86b7dffb91b80bb65f4d9b43cdc6555c12b5ba
SHA512 e346b00e9ebd4bb4c2831b24c801a34e8401a3999abb3c9cc8019fa34e53e00632fd21a22ad8657df7742c1ee978cc1cc9ec38aabadb3ab548b3991e5aec944e
SSDEEP 12288:XO4rfItL8HPEHBk1mk6p4vqJTGsZVqMPCt7Q8mO4rfIt+2:XO4rQtGPEhOmzbJTnTZCdmO4rQt+2
TLSH
T1DCD4E025B340C036D69512355BE3AB29667A7DB40B11A5C33B8027BD2EB42E2D77D34F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1752	3985.tmp

Executes dropped EXE 1 IoCs

pid	Process
1752	3985.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b65b2424e5320c302cefac03d040f9d2_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3985.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 1752	476	2026-07-20_b65b2424e5320c302cefac03d040f9d2_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b65b2424e5320c302cefac03d040f9d2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b65b2424e5320c302cefac03d040f9d2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:476
- C:\Users\Admin\AppData\Local\Temp\3985.tmp
  "C:\Users\Admin\AppData\Local\Temp\3985.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_b65b2424e5320c302cefac03d040f9d2_elex_mafia_stealc_tofsee.exe 71D32D8557F8EB20737A093CD27F6C49F17976CF4D91EFE2B2CD2F34F0F50812099D3FEA32A70868BFF8DE3A25D8513532FFC1AC9B3D67C5A8E0B684409A692B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3985.tmp

Path C:\Users\Admin\AppData\Local\Temp\3985.tmp
Size 613KB
SHA256 ffa7b99cec07c3ee4765b9f712c06dab7dd547a1daa2fe1e9f43112aaaa8f298
MD5 8484a039de7646b298886079ac303065
SHA1 3622f1cc1a1d2b348f257b8554930877b8a45f9a
SHA512 d7c5c3f9ec8e13a0603fa21f61c2ef7e6f2849c04da9fbb39961264017df9f91ba05aff4deaa0c381819e80f43e100b2dc7ce8c61689db5d22368a7ce5187df5
SSDEEP 12288:XO4rfItL8HPyySj+lNR7qhqoL27Q8mO4rfIt+2:XO4rQtGPzSj+lPqEi2dmO4rQt+2
TLSH
T126D4F125B741C037D1A211395BD2AB6A663A7E740B12A5C33B942B7D2FB01E2D73934F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download